Whenever you are searching for SQL query optimization tips or prevent SQL injection tips, you can find few common suggestions like: Please do not use Dynamic SQL in your Stored Procedure. Please try to avoid the use of Temp Tables.

I always tell to database developers, please try to avoid the use of Dynamic SQL and Temp Table in your Stored Procedures.

A Temp Table requires additional CPU/IO which degrades the query performance. A Dynamic SQL is not safe against the SQL Injection and It also compiles data every time which requires more Memory.

Here, I am sharing one of the important scripts which gives you list of SQL Server Stored Procedures, which use the Dynamic SQL and Temp Table.
You can easily get the list of Stored Procedures and can make plans of modifying it.

Prepared this script using sys.dm_exec_describe_first_result_set and sys.procedures where error number 4 = Dynamic SQL and error number 10 = Temporary Table.

SELECT  
	SP_Name
	,error_message
	,error_type_desc 
FROM (SELECT schema_name(schema_id)+'.'+name SP_Name FROM sys.procedures) AS T
CROSS APPLY sys.dm_exec_describe_first_result_set (SP_Name, NULL, 0) 
WHERE error_type IN (4,10)

I received many emails on, how can I write dynamic SQL in MySQL Stored Procedure.

I understood that the database professional tried to find Dynamic SQL in MySQL like SQL Server or PostgreSQL.

MySQL Doesn’t Support dynamic SQL in Stored Procedure. Even dynamic SQL is not good for database security because of SQL Injections.
You have to write prepared statement for this requirement.

Please visit below article on Prepared Statements:

Prepared or Parameterized Statements in Database System

In this post, I am sharing demonstration on a dynamic SQL as a prepared statement in the MySQL Stored Procedure.

First, create a sample table and data

CREATE TABLE tbl_TestDynamicSQL
(
    EmpID INTEGER
    ,EmpName VARCHAR(255)    
);

INSERT INTO tbl_TestDynamicSQL 
VALUES (1,'ABC'),(2,'XYZ'),(3,'PQR'),(4,'RFQ');

Now, create a stored procedure and pass the column name dynamically:

DELIMITER $$
CREATE PROCEDURE usp_GetEmployeeDetailsDynamic
(
	IN ColumnName VARCHAR(255)
)
BEGIN
    SET @SQLText = CONCAT('SELECT ',ColumnName,' FROM tbl_TestDynamicSQL ');    
    PREPARE stmt FROM @SQLText;
    EXECUTE stmt;
    DEALLOCATE PREPARE stmt;
END$$
DELIMITER ;

Call this stored procedure by giving desire column name and it will return only data for that column:

CALL usp_GetEmployeeDetailsDynamic ('EmpName');

In this post, I am sharing a demonstration on the Dynamic SQL Query of PostgreSQL.

Many times custom filters and sorting requires for selecting customized data.

Generally, what we are doing is, we call a stored procedure using master filters and display results on grid or report, but user requires a more custom filter on returned data.

You can also say like the user needs particular column filtering. Now, this column filter called as custom filtering and which we can achieve by dynamic SQL.
The user can also demand custom sorting, for this, we have to construct SQL using custom sorting column.

Dynamic SQL means, you can prepare or build your SQL statement basis on different parameters or results.

Below is a demonstration of PostgreSQL dynamic query using a custom filter.

First create one sample Employee table using 10 test records.

CREATE TABLE Employee
(
 EmpID SERIAL
 ,EmpName CHARACTER VARYING(50)
 ,Gender CHAR(1)
 ,AGE SMALLINT
);

INSERT INTO Employee 
(
 EmpName 
 ,Gender 
 ,AGE 
)
VALUES 
 ('Anvesh','M',27)
 ,('Mohan','M',30)
 ,('Roy','M',31)
 ,('Meera','F',27)
 ,('Richa','F',26)
 ,('Martin','M',35)
 ,('Mahesh','M',38)
 ,('Paresh','M',22)
 ,('Alina','F',21)
 ,('Alex','M',24);

Below is a sample stored procedure:

CREATE OR REPLACE FUNCTION fn_GetEmployeeDataByCustomFilter
(
 Paging_PageSize INTEGER = NULL
 ,Paging_PageNumber INTEGER = NULL   
 ,Paging_ColumnFilterExpression TEXT = NULL
 ,Paging_SortExpression TEXT = NULL
)

RETURNS TABLE 
( 
 EmpID INTEGER
 ,EmpName CHARACTER VARYING
 ,Gender CHAR(1)
 ,Age SMALLINT
) AS
$BODY$
DECLARE 

         PageNumber BIGINT;
         SQL TEXT; 
         Paging_PageFilterExpression VARCHAR;  
BEGIN 
 /****************************************************************
 Construct Where expression for Custom Paging 
 **************************************************************** */
 IF Paging_ColumnFilterExpression IS NULL THEN
  Paging_ColumnFilterExpression := ' ';
 ELSE
  Paging_ColumnFilterExpression := ' AND ' || Paging_ColumnFilterExpression;
 END IF; 
 /****************************************************************
 Construct Sort expression for Custom Paging 
 **************************************************************** */
 IF paging_sortexpression IS NULL THEN
  paging_sortexpression := 'EmpName'; 
 END IF;  
 /****************************************************************
 Construct Custom paging parameter...
 **************************************************************** */
 IF (paging_pagesize IS NOT NULL AND paging_pagenumber IS NOT NULL) THEN
  PageNumber := (Paging_PageSize * (Paging_PageNumber-1)); 
 END IF;    
 /* ***************************************************************
 Custome paging SQL Query construction.......
 **************************************************************** */
 SQL :=
 '
 WITH cteCustomFilter AS
 (
  SELECT
    EmpID
    ,EmpName
    ,Gender
    ,Age
  FROM public.Employee
  WHERE 1=1 '||Paging_ColumnFilterExpression||'
  ORDER BY '||paging_sortexpression||' 
 )
 SELECT 
   EmpID
   ,EmpName
   ,Gender
   ,Age
 FROM cteCustomFilter ';

 

 IF (paging_pagesize IS NOT NULL AND paging_pagenumber IS NOT NULL) THEN  
  SQL:= SQL || 'LIMIT '||Paging_PageSize||' OFFSET '||PageNumber;
 END IF; 

 RETURN QUERY EXECUTE SQL;
  
 EXCEPTION WHEN OTHERS THEN 
 RAISE;
END;
$BODY$
LANGUAGE 'plpgsql';

Show some results:

SELECT *FROM public.fn_GetEmployeeDataByCustomFilter(3,1,'empname=''Mahesh''',NULL)

In the above call, I filtered only “Mahesh” so it returned only one record.

The application is responsible to create this custom parameter for a custom filter. You just need to append filter or sorting string with main SQL Query.

This stored procedure has four parameters first two for custom paging and last two for custom filter and sorting.

Please visit this URL: to understand custom paging.

PostgreSQL Custom Paging using LIMIT and OFFSET

Now, about the dynamic query in which I am passing filter column name through input parameter.

This filter and sorting parameter are required to concat with the main SQL query for customized results.

input parameter: Paging_ColumnFilterExpression is for custom filter and Paging_SortExpression is for custom sorting.

You should also set some default value for this kind of variables or parameters.

Now examine second sample:

SELECT *FROM public.fn_GetEmployeeDataByCustomFilter(5,1,'empname like ''%M%''','age desc')

You can see both filters and sort in this result.

We have sort age column by descending and select employee starting with ‘M’.